ad1795113e302772c08f24c6c1947da43b2b9c82c77c9c906ec616fb39214f8b

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 21:57

Target

AD1795113E302772C08F24C6C1947DA43B2B9C82C77C9.exe
Size

1.6MB
MD5

c656855186dedce4c57f1eedb3bdf242
SHA1

0663f5d6cdee325bc0be279f7e81f150921c6a96
SHA256

ad1795113e302772c08f24c6c1947da43b2b9c82c77c9c906ec616fb39214f8b
SHA512

4ed2150b213bfadbf7f2513eb6159d67d0b6410c55db0c533fb1b577474559f52d3ee3fcdcbf89cea5aaf1b9f72d77c6de6bc61acf9017e9f700d80a590569b5
SSDEEP

24576:s7FUDowAyrTVE3U5F/midGKic6QL3E2vVsjECUAQT45deRV9RJ:sBuZrEUAKIy029s4C1eH9P

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4492	AD1795113E302772C08F24C6C1947DA43B2B9C82C77C9.tmp

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1536	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 4492	3484	AD1795113E302772C08F24C6C1947DA43B2B9C82C77C9.exe	86
PID 3484 wrote to memory of 4492	3484	AD1795113E302772C08F24C6C1947DA43B2B9C82C77C9.exe	86
PID 3484 wrote to memory of 4492	3484	AD1795113E302772C08F24C6C1947DA43B2B9C82C77C9.exe	86

C:\Users\Admin\AppData\Local\Temp\AD1795113E302772C08F24C6C1947DA43B2B9C82C77C9.exe
"C:\Users\Admin\AppData\Local\Temp\AD1795113E302772C08F24C6C1947DA43B2B9C82C77C9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Users\Admin\AppData\Local\Temp\is-QE43Q.tmp\AD1795113E302772C08F24C6C1947DA43B2B9C82C77C9.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-QE43Q.tmp\AD1795113E302772C08F24C6C1947DA43B2B9C82C77C9.tmp" /SL5="$80162,832512,832512,C:\Users\Admin\AppData\Local\Temp\AD1795113E302772C08F24C6C1947DA43B2B9C82C77C9.exe"
  2⤵
  - Executes dropped EXE
  PID:4492

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Users\Admin\AppData\Local\Temp\is-QE43Q.tmp\AD1795113E302772C08F24C6C1947DA43B2B9C82C77C9.tmp

Filesize
3.1MB

MD5
9f2b0a7592a5085bbc343863e47966c8

SHA1
a2344b1f925221c1e1861b1a29d149c0cf2b0e4d

SHA256
6158145460959c5bbd215c15230046c5f7a0ac10250bb7efb1538c4aba335dc2

SHA512
f6d6dd1dfff43df25a02caa9084d4ac606b5465a90fa43a26e62fa34aa4f467af96e5df49bd7c1d66431f6ee66041843e4bdde333761c1ff3e3d194e6f19816a

Download Submit
memory/1536-28-0x000001572AD40000-0x000001572AD50000-memory.dmp

Filesize
64KB

Download
memory/1536-44-0x000001572AE40000-0x000001572AE50000-memory.dmp

Filesize
64KB

Download
memory/1536-60-0x0000015733150000-0x0000015733151000-memory.dmp

Filesize
4KB

Download
memory/1536-62-0x0000015733180000-0x0000015733181000-memory.dmp

Filesize
4KB

Download
memory/1536-63-0x0000015733180000-0x0000015733181000-memory.dmp

Filesize
4KB

Download
memory/1536-64-0x0000015733290000-0x0000015733291000-memory.dmp

Filesize
4KB

Download
memory/3484-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3484-7-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4492-5-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/4492-8-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4492-11-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download